Commit 920f0ae7 authored Apr 17, 2022 by Duoming Zhou Committed by Greg Kroah-Hartman Jun 14, 2022

drivers: tty: serial: Fix deadlock in sa1100_set_termios()



[ Upstream commit 62b2caef400c1738b6d22f636c628d9f85cd4c4c ]

There is a deadlock in sa1100_set_termios(), which is shown
below:

   (Thread 1)              |      (Thread 2)
                           | sa1100_enable_ms()
sa1100_set_termios()       |  mod_timer()
 spin_lock_irqsave() //(1) |  (wait a time)
 ...                       | sa1100_timeout()
 del_timer_sync()          |  spin_lock_irqsave() //(2)
 (wait timer to stop)      |  ...

We hold sport->port.lock in position (1) of thread 1 and
use del_timer_sync() to wait timer to stop, but timer handler
also need sport->port.lock in position (2) of thread 2. As a result,
sa1100_set_termios() will block forever.

This patch moves del_timer_sync() before spin_lock_irqsave()
in order to prevent the deadlock.

Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Link: https://lore.kernel.org/r/20220417111626.7802-1-duoming@zju.edu.cn


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 3825db88

drivers/tty/serial/sa1100.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -439,6 +439,8 @@ sa1100_set_termios(struct uart_port port, struct ktermios termios,
		baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk/16);
		quot = uart_get_divisor(port, baud);

		del_timer_sync(&sport->timer);

		spin_lock_irqsave(&sport->port.lock, flags);

		sport->port.read_status_mask &= UTSR0_TO_SM(UTSR0_TFS);
		@@ -469,8 +471,6 @@ sa1100_set_termios(struct uart_port port, struct ktermios termios,
		UTSR1_TO_SM(UTSR1_ROR);
		}

		del_timer_sync(&sport->timer);

		/*
		* Update the per-port timeout.
		*/